@nestjs-kit/better-auth 0.0.0-stage → 2.0.0

package/dist/auth-scope-interceptor-BjxAL1-S.cjs

@@ -0,0 +1,290 @@
+const require_auth_errors = require("./auth-errors-DmiKl0L_.cjs");
+const require_decorate = require("./decorate-Cr4Q7bNE.cjs");
+let _nestjs_common = require("@nestjs/common");
+let rxjs = require("rxjs");
+//#region src/principal-resolver.ts
+const definePrincipalSource = (source) => source;
+const authenticated = (principal) => ({
+	outcome: "authenticated",
+	principal
+});
+const absent = () => ({ outcome: "absent" });
+const rejected = (failure) => ({
+	outcome: "rejected",
+	failure
+});
+var MemoKeys = class {
+	owners = /* @__PURE__ */ new WeakMap();
+	key(owner, namespace, value) {
+		if (typeof value === "string") return JSON.stringify([
+			namespace,
+			"string",
+			value
+		]);
+		let identities = this.owners.get(owner);
+		if (!identities) {
+			identities = {
+				objects: /* @__PURE__ */ new WeakMap(),
+				symbols: /* @__PURE__ */ new Map(),
+				next: 0
+			};
+			this.owners.set(owner, identities);
+		}
+		let id = typeof value === "symbol" ? identities.symbols.get(value) : identities.objects.get(value);
+		if (id === void 0) {
+			id = ++identities.next;
+			if (typeof value === "symbol") identities.symbols.set(value, id);
+			else identities.objects.set(value, id);
+		}
+		return JSON.stringify([
+			namespace,
+			typeof value,
+			id
+		]);
+	}
+};
+function requestHeaders(call, entry) {
+	const headers = new Headers(call.headers());
+	for (const name of [...headers.keys()]) if (name.startsWith(":") || name.startsWith("x-nestjs-kit-better-auth-ip-") || name === entry.bridge.clientIpHeader) headers.delete(name);
+	if (entry.bridge.clientIpHeader && call.clientIp) headers.set(entry.bridge.clientIpHeader, call.clientIp);
+	return headers;
+}
+function normalizeForRequest(error, where, site, entry, headers) {
+	try {
+		return require_auth_errors.normalizeThrown(error, where, site, [], entry.options.errors);
+	} catch (normalized) {
+		if (require_auth_errors.isConfigurationError(normalized)) throw normalized;
+		if (require_auth_errors.isInfrastructureError(error) && normalized === error) throw require_auth_errors.redactForRequest(error, {
+			headers,
+			credentialHeaders: entry.credentialHeaders,
+			exposeRawCause: entry.options.errors?.exposeRawCause
+		});
+		throw require_auth_errors.createInfrastructureError(error, {
+			headers,
+			credentialHeaders: entry.credentialHeaders,
+			exposeRawCause: entry.options.errors?.exposeRawCause
+		});
+	}
+}
+var ChainPrincipalResolver = class {
+	instances;
+	scope;
+	transports;
+	keys = new MemoKeys();
+	constructor(instances, scope, transports) {
+		this.instances = instances;
+		this.scope = scope;
+		this.transports = transports;
+	}
+	resolve(call, request) {
+		const entry = this.instances.get(request.auth.name);
+		const compute = async () => {
+			const headers = requestHeaders(call, entry);
+			const sources = request.reclassify ? entry.sources.filter((source) => source.id === request.reclassify.sourceId && source.sessionBacked) : entry.sources.filter((source) => source.kinds.some((kind) => request.accepts.has(kind)));
+			return request.auth.run({
+				cookies: call.cookies,
+				forward: "same-credential",
+				inbound: () => headers,
+				internal: true
+			}, async () => {
+				for (const source of sources) {
+					const input = {
+						headers,
+						cookies: call.cookies,
+						transport: this.transports.idOf(call),
+						request: call.request,
+						freshness: request.freshness,
+						auth: request.auth,
+						memo: (key, fn) => this.scope.memoPolicyIo(call.key, entry.name, this.keys.key(call.key, `source:${source.id}`, key), fn, entry.options.limits?.maxAuthorizationCallsPerRequest)
+					};
+					try {
+						if (source.appliesTo && !source.appliesTo(input)) continue;
+						const result = await source.resolve(input);
+						if (result.outcome === "authenticated" && (!source.kinds.includes(result.principal.kind) || result.principal.source !== source.id || Boolean(result.principal.delegation) !== Boolean(source.delegates))) throw new Error(`Principal source ${source.id} violated its declared principal contract`);
+						if (result.outcome !== "absent") return result;
+					} catch (error) {
+						const failure = normalizeForRequest(error, "source", source.id, entry, headers);
+						if (require_auth_errors.isAuthFailure(failure)) return rejected(failure);
+						throw error;
+					}
+				}
+				return absent();
+			});
+		};
+		return request.reclassify ? compute() : this.scope.memoPrincipal(call, {
+			instance: entry.name,
+			freshness: request.freshness,
+			sourceSet: request.sourceSet
+		}, compute);
+	}
+};
+//#endregion
+//#region src/auth-scope-interceptor.ts
+let BetterAuthScopeInterceptor = class BetterAuthScopeInterceptor {
+	core;
+	static [require_decorate.AUTH_ENHANCER] = "scope";
+	[require_decorate.AUTH_ENHANCER] = "scope";
+	constructor(core) {
+		this.core = core;
+	}
+	intercept(context, next) {
+		return this.core.intercept(context, next);
+	}
+};
+BetterAuthScopeInterceptor = require_decorate.__decorate([
+	(0, _nestjs_common.Injectable)(),
+	require_decorate.__decorateParam(0, (0, _nestjs_common.Inject)(require_decorate.SCOPE_CORE)),
+	require_decorate.__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthScopeInterceptor);
+var ScopeCore = class {
+	instances;
+	planner;
+	transports;
+	scope;
+	readings;
+	constructor(instances, planner, transports, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	intercept(context, next) {
+		const plan = this.planner.forContext(context);
+		const entry = this.instances.get(plan.instance);
+		let described = false;
+		let call;
+		const getCall = () => {
+			if (!described) {
+				const transport = this.transports.find(context);
+				call = transport ? this.transports.describe(context, transport) : void 0;
+				described = true;
+			}
+			return call;
+		};
+		let reading;
+		const read = () => {
+			if (reading) return reading;
+			const lineage = this.transports.find(context)?.lineage?.(context);
+			reading = this.readings.read({
+				args: context.getArgs(),
+				plan,
+				lineage,
+				...plan.access === "public" || plan.access === "inherit" ? {} : { call: getCall() }
+			});
+			return reading;
+		};
+		const instances = this.instances;
+		const state = {
+			view: {
+				get cookies() {
+					return getCall()?.cookies ?? null;
+				},
+				forward: plan.forwardDirectCalls ? "same-credential" : "none",
+				internal: false,
+				get inbound() {
+					return () => {
+						const call = getCall();
+						return call ? requestHeaders(call, entry) : new Headers();
+					};
+				},
+				get browserHeaders() {
+					const browser = getCall()?.browser;
+					return browser ? () => browser.headers() : void 0;
+				},
+				get checkCallerSession() {
+					if (plan.originCheck === "off") return;
+					const browser = getCall()?.browser;
+					return browser ? (path, instance) => instances.get(instance).origin.assertCallerSession(browser, path, instance) : void 0;
+				}
+			},
+			plan,
+			reading: read,
+			get call() {
+				return getCall();
+			}
+		};
+		const args = context.getArgs();
+		const bridge = {
+			args: [...args],
+			reading: read,
+			scope: this.scope,
+			readings: this.readings
+		};
+		for (const arg of [args, ...args]) if (arg && (typeof arg === "object" || typeof arg === "function") && Object.isExtensible(arg)) Object.defineProperty(arg, require_decorate.READER_CONTEXT, {
+			value: bridge,
+			configurable: true
+		});
+		return new rxjs.Observable((subscriber) => this.scope.run(state, () => {
+			const subscription = next.handle().subscribe({
+				next: (value) => this.scope.run(state, () => subscriber.next(value)),
+				error: (error) => this.scope.run(state, () => subscriber.error(error)),
+				complete: () => this.scope.run(state, () => subscriber.complete())
+			});
+			return () => this.scope.run(state, () => subscription.unsubscribe());
+		}));
+	}
+};
+//#endregion
+Object.defineProperty(exports, "BetterAuthScopeInterceptor", {
+	enumerable: true,
+	get: function() {
+		return BetterAuthScopeInterceptor;
+	}
+});
+Object.defineProperty(exports, "ChainPrincipalResolver", {
+	enumerable: true,
+	get: function() {
+		return ChainPrincipalResolver;
+	}
+});
+Object.defineProperty(exports, "MemoKeys", {
+	enumerable: true,
+	get: function() {
+		return MemoKeys;
+	}
+});
+Object.defineProperty(exports, "ScopeCore", {
+	enumerable: true,
+	get: function() {
+		return ScopeCore;
+	}
+});
+Object.defineProperty(exports, "absent", {
+	enumerable: true,
+	get: function() {
+		return absent;
+	}
+});
+Object.defineProperty(exports, "authenticated", {
+	enumerable: true,
+	get: function() {
+		return authenticated;
+	}
+});
+Object.defineProperty(exports, "definePrincipalSource", {
+	enumerable: true,
+	get: function() {
+		return definePrincipalSource;
+	}
+});
+Object.defineProperty(exports, "normalizeForRequest", {
+	enumerable: true,
+	get: function() {
+		return normalizeForRequest;
+	}
+});
+Object.defineProperty(exports, "rejected", {
+	enumerable: true,
+	get: function() {
+		return rejected;
+	}
+});
+Object.defineProperty(exports, "requestHeaders", {
+	enumerable: true,
+	get: function() {
+		return requestHeaders;
+	}
+});
+
+//# sourceMappingURL=auth-scope-interceptor-BjxAL1-S.cjs.map

package/dist/auth-scope-interceptor-BjxAL1-S.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-scope-interceptor-BjxAL1-S.cjs","names":["normalizeThrown","isConfigurationError","isInfrastructureError","redactForRequest","createInfrastructureError","isAuthFailure","AUTH_ENHANCER","Injectable","Inject","SCOPE_CORE","READER_CONTEXT","Observable"],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAOA,oBAAAA,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAIC,oBAAAA,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAIC,oBAAAA,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAMC,oBAAAA,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAMC,oBAAAA,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAIC,oBAAAA,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiBC,iBAAAA,iBAAiB;CAClC,CAAUA,iBAAAA,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;EAZCC,GAAAA,eAAAA,WAAAA,CAAW;CAMPC,iBAAAA,gBAAAA,IAAAA,GAAAA,eAAAA,OAAAA,CAAOC,iBAAAA,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAKC,iBAAAA,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAIC,KAAAA,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}

package/dist/auth-scope-interceptor-DYPn3b8M.mjs

@@ -0,0 +1,231 @@
+import { c as isConfigurationError, d as redactForRequest, i as createInfrastructureError, l as isInfrastructureError, s as isAuthFailure, u as normalizeThrown } from "./auth-errors-C3rbTV9p.mjs";
+import { O as SCOPE_CORE, n as __decorateParam, r as __decorateMetadata, s as AUTH_ENHANCER, t as __decorate, w as READER_CONTEXT } from "./decorate-Dt0e9K6R.mjs";
+import { Inject, Injectable } from "@nestjs/common";
+import { Observable } from "rxjs";
+//#region src/principal-resolver.ts
+const definePrincipalSource = (source) => source;
+const authenticated = (principal) => ({
+	outcome: "authenticated",
+	principal
+});
+const absent = () => ({ outcome: "absent" });
+const rejected = (failure) => ({
+	outcome: "rejected",
+	failure
+});
+var MemoKeys = class {
+	owners = /* @__PURE__ */ new WeakMap();
+	key(owner, namespace, value) {
+		if (typeof value === "string") return JSON.stringify([
+			namespace,
+			"string",
+			value
+		]);
+		let identities = this.owners.get(owner);
+		if (!identities) {
+			identities = {
+				objects: /* @__PURE__ */ new WeakMap(),
+				symbols: /* @__PURE__ */ new Map(),
+				next: 0
+			};
+			this.owners.set(owner, identities);
+		}
+		let id = typeof value === "symbol" ? identities.symbols.get(value) : identities.objects.get(value);
+		if (id === void 0) {
+			id = ++identities.next;
+			if (typeof value === "symbol") identities.symbols.set(value, id);
+			else identities.objects.set(value, id);
+		}
+		return JSON.stringify([
+			namespace,
+			typeof value,
+			id
+		]);
+	}
+};
+function requestHeaders(call, entry) {
+	const headers = new Headers(call.headers());
+	for (const name of [...headers.keys()]) if (name.startsWith(":") || name.startsWith("x-nestjs-kit-better-auth-ip-") || name === entry.bridge.clientIpHeader) headers.delete(name);
+	if (entry.bridge.clientIpHeader && call.clientIp) headers.set(entry.bridge.clientIpHeader, call.clientIp);
+	return headers;
+}
+function normalizeForRequest(error, where, site, entry, headers) {
+	try {
+		return normalizeThrown(error, where, site, [], entry.options.errors);
+	} catch (normalized) {
+		if (isConfigurationError(normalized)) throw normalized;
+		if (isInfrastructureError(error) && normalized === error) throw redactForRequest(error, {
+			headers,
+			credentialHeaders: entry.credentialHeaders,
+			exposeRawCause: entry.options.errors?.exposeRawCause
+		});
+		throw createInfrastructureError(error, {
+			headers,
+			credentialHeaders: entry.credentialHeaders,
+			exposeRawCause: entry.options.errors?.exposeRawCause
+		});
+	}
+}
+var ChainPrincipalResolver = class {
+	instances;
+	scope;
+	transports;
+	keys = new MemoKeys();
+	constructor(instances, scope, transports) {
+		this.instances = instances;
+		this.scope = scope;
+		this.transports = transports;
+	}
+	resolve(call, request) {
+		const entry = this.instances.get(request.auth.name);
+		const compute = async () => {
+			const headers = requestHeaders(call, entry);
+			const sources = request.reclassify ? entry.sources.filter((source) => source.id === request.reclassify.sourceId && source.sessionBacked) : entry.sources.filter((source) => source.kinds.some((kind) => request.accepts.has(kind)));
+			return request.auth.run({
+				cookies: call.cookies,
+				forward: "same-credential",
+				inbound: () => headers,
+				internal: true
+			}, async () => {
+				for (const source of sources) {
+					const input = {
+						headers,
+						cookies: call.cookies,
+						transport: this.transports.idOf(call),
+						request: call.request,
+						freshness: request.freshness,
+						auth: request.auth,
+						memo: (key, fn) => this.scope.memoPolicyIo(call.key, entry.name, this.keys.key(call.key, `source:${source.id}`, key), fn, entry.options.limits?.maxAuthorizationCallsPerRequest)
+					};
+					try {
+						if (source.appliesTo && !source.appliesTo(input)) continue;
+						const result = await source.resolve(input);
+						if (result.outcome === "authenticated" && (!source.kinds.includes(result.principal.kind) || result.principal.source !== source.id || Boolean(result.principal.delegation) !== Boolean(source.delegates))) throw new Error(`Principal source ${source.id} violated its declared principal contract`);
+						if (result.outcome !== "absent") return result;
+					} catch (error) {
+						const failure = normalizeForRequest(error, "source", source.id, entry, headers);
+						if (isAuthFailure(failure)) return rejected(failure);
+						throw error;
+					}
+				}
+				return absent();
+			});
+		};
+		return request.reclassify ? compute() : this.scope.memoPrincipal(call, {
+			instance: entry.name,
+			freshness: request.freshness,
+			sourceSet: request.sourceSet
+		}, compute);
+	}
+};
+//#endregion
+//#region src/auth-scope-interceptor.ts
+let BetterAuthScopeInterceptor = class BetterAuthScopeInterceptor {
+	core;
+	static [AUTH_ENHANCER] = "scope";
+	[AUTH_ENHANCER] = "scope";
+	constructor(core) {
+		this.core = core;
+	}
+	intercept(context, next) {
+		return this.core.intercept(context, next);
+	}
+};
+BetterAuthScopeInterceptor = __decorate([
+	Injectable(),
+	__decorateParam(0, Inject(SCOPE_CORE)),
+	__decorateMetadata("design:paramtypes", [typeof Pick === "undefined" ? Object : Pick])
+], BetterAuthScopeInterceptor);
+var ScopeCore = class {
+	instances;
+	planner;
+	transports;
+	scope;
+	readings;
+	constructor(instances, planner, transports, scope, readings) {
+		this.instances = instances;
+		this.planner = planner;
+		this.transports = transports;
+		this.scope = scope;
+		this.readings = readings;
+	}
+	intercept(context, next) {
+		const plan = this.planner.forContext(context);
+		const entry = this.instances.get(plan.instance);
+		let described = false;
+		let call;
+		const getCall = () => {
+			if (!described) {
+				const transport = this.transports.find(context);
+				call = transport ? this.transports.describe(context, transport) : void 0;
+				described = true;
+			}
+			return call;
+		};
+		let reading;
+		const read = () => {
+			if (reading) return reading;
+			const lineage = this.transports.find(context)?.lineage?.(context);
+			reading = this.readings.read({
+				args: context.getArgs(),
+				plan,
+				lineage,
+				...plan.access === "public" || plan.access === "inherit" ? {} : { call: getCall() }
+			});
+			return reading;
+		};
+		const instances = this.instances;
+		const state = {
+			view: {
+				get cookies() {
+					return getCall()?.cookies ?? null;
+				},
+				forward: plan.forwardDirectCalls ? "same-credential" : "none",
+				internal: false,
+				get inbound() {
+					return () => {
+						const call = getCall();
+						return call ? requestHeaders(call, entry) : new Headers();
+					};
+				},
+				get browserHeaders() {
+					const browser = getCall()?.browser;
+					return browser ? () => browser.headers() : void 0;
+				},
+				get checkCallerSession() {
+					if (plan.originCheck === "off") return;
+					const browser = getCall()?.browser;
+					return browser ? (path, instance) => instances.get(instance).origin.assertCallerSession(browser, path, instance) : void 0;
+				}
+			},
+			plan,
+			reading: read,
+			get call() {
+				return getCall();
+			}
+		};
+		const args = context.getArgs();
+		const bridge = {
+			args: [...args],
+			reading: read,
+			scope: this.scope,
+			readings: this.readings
+		};
+		for (const arg of [args, ...args]) if (arg && (typeof arg === "object" || typeof arg === "function") && Object.isExtensible(arg)) Object.defineProperty(arg, READER_CONTEXT, {
+			value: bridge,
+			configurable: true
+		});
+		return new Observable((subscriber) => this.scope.run(state, () => {
+			const subscription = next.handle().subscribe({
+				next: (value) => this.scope.run(state, () => subscriber.next(value)),
+				error: (error) => this.scope.run(state, () => subscriber.error(error)),
+				complete: () => this.scope.run(state, () => subscriber.complete())
+			});
+			return () => this.scope.run(state, () => subscription.unsubscribe());
+		}));
+	}
+};
+//#endregion
+export { absent as a, normalizeForRequest as c, MemoKeys as i, rejected as l, ScopeCore as n, authenticated as o, ChainPrincipalResolver as r, definePrincipalSource as s, BetterAuthScopeInterceptor as t, requestHeaders as u };
+
+//# sourceMappingURL=auth-scope-interceptor-DYPn3b8M.mjs.map

package/dist/auth-scope-interceptor-DYPn3b8M.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-scope-interceptor-DYPn3b8M.mjs","names":[],"sources":["../src/principal-resolver.ts","../src/auth-scope-interceptor.ts"],"sourcesContent":["import type {\n  AuthPrincipalBase,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  ResolutionRequest,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  type AuthFailure,\n  isAuthFailure,\n  normalizeThrown,\n  createInfrastructureError,\n  isConfigurationError,\n  isInfrastructureError,\n  redactForRequest,\n} from \"./auth-errors.js\";\nimport type { InstanceEntry, InstanceLookup } from \"./instance-registry.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\nimport type { RequestScope } from \"./request-scope.js\";\n\nexport const definePrincipalSource = <P extends AuthPrincipalBase>(\n  source: PrincipalSource<P>,\n): PrincipalSource<P> => source;\nexport const authenticated = <P extends AuthPrincipalBase>(\n  principal: P,\n): PrincipalResult<P> => ({ outcome: \"authenticated\", principal });\nexport const absent = (): PrincipalResult<never> => ({ outcome: \"absent\" });\nexport const rejected = (failure: AuthFailure): PrincipalResult<never> => ({\n  outcome: \"rejected\",\n  failure,\n});\n\nexport class MemoKeys {\n  private readonly owners = new WeakMap<\n    object,\n    {\n      objects: WeakMap<object, number>;\n      symbols: Map<symbol, number>;\n      next: number;\n    }\n  >();\n\n  key(\n    owner: object,\n    namespace: string,\n    value: string | object | symbol,\n  ): string {\n    if (typeof value === \"string\") {\n      return JSON.stringify([namespace, \"string\", value]);\n    }\n    let identities = this.owners.get(owner);\n    if (!identities) {\n      identities = { objects: new WeakMap(), symbols: new Map(), next: 0 };\n      this.owners.set(owner, identities);\n    }\n    let id =\n      typeof value === \"symbol\"\n        ? identities.symbols.get(value)\n        : identities.objects.get(value);\n    if (id === undefined) {\n      id = ++identities.next;\n      if (typeof value === \"symbol\") {\n        identities.symbols.set(value, id);\n      } else {\n        identities.objects.set(value, id);\n      }\n    }\n    return JSON.stringify([namespace, typeof value, id]);\n  }\n}\nexport function requestHeaders(\n  call: TransportCall,\n  entry: InstanceEntry,\n): Headers {\n  const headers = new Headers(call.headers());\n  for (const name of [...headers.keys()]) {\n    if (\n      name.startsWith(\":\") ||\n      name.startsWith(\"x-nestjs-kit-better-auth-ip-\") ||\n      name === entry.bridge.clientIpHeader\n    ) {\n      headers.delete(name);\n    }\n  }\n  if (entry.bridge.clientIpHeader && call.clientIp) {\n    headers.set(entry.bridge.clientIpHeader, call.clientIp);\n  }\n  return headers;\n}\nexport function normalizeForRequest(\n  error: unknown,\n  where: \"source\" | \"policy\",\n  site: string,\n  entry: InstanceEntry,\n  headers: Headers,\n) {\n  try {\n    return normalizeThrown(error, where, site, [], entry.options.errors);\n  } catch (normalized) {\n    if (isConfigurationError(normalized)) {\n      throw normalized;\n    }\n    if (isInfrastructureError(error) && normalized === error) {\n      // A source or policy classified this failure itself, redacting only what it knew.\n      throw redactForRequest(error, {\n        headers,\n        credentialHeaders: entry.credentialHeaders,\n        exposeRawCause: entry.options.errors?.exposeRawCause,\n      });\n    }\n    throw createInfrastructureError(error, {\n      headers,\n      credentialHeaders: entry.credentialHeaders,\n      exposeRawCause: entry.options.errors?.exposeRawCause,\n    });\n  }\n}\nexport class ChainPrincipalResolver implements PrincipalResolver {\n  private readonly keys = new MemoKeys();\n\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly scope: RequestScope,\n    private readonly transports: TransportRegistry,\n  ) {}\n\n  resolve(\n    call: TransportCall,\n    request: ResolutionRequest,\n  ): Promise<PrincipalResult> {\n    const entry = this.instances.get(request.auth.name);\n    const compute = async (): Promise<PrincipalResult> => {\n      const headers = requestHeaders(call, entry);\n      const sources = request.reclassify\n        ? entry.sources.filter(\n            (source) =>\n              source.id === request.reclassify!.sourceId &&\n              source.sessionBacked,\n          )\n        : entry.sources.filter((source) =>\n            source.kinds.some((kind) => request.accepts.has(kind)),\n          );\n      return request.auth.run(\n        {\n          cookies: call.cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          for (const source of sources) {\n            const input = {\n              headers,\n              cookies: call.cookies,\n              transport: this.transports.idOf(call),\n              request: call.request,\n              freshness: request.freshness,\n              auth: request.auth,\n              memo: <T>(\n                key: string | object | symbol,\n                fn: () => Promise<T>,\n              ): Promise<T> =>\n                this.scope.memoPolicyIo(\n                  call.key,\n                  entry.name,\n                  this.keys.key(call.key, `source:${source.id}`, key),\n                  fn,\n                  entry.options.limits?.maxAuthorizationCallsPerRequest,\n                ),\n            };\n            try {\n              if (source.appliesTo && !source.appliesTo(input)) {\n                continue;\n              }\n              const result = await source.resolve(input);\n              if (\n                result.outcome === \"authenticated\" &&\n                (!source.kinds.includes(result.principal.kind) ||\n                  result.principal.source !== source.id ||\n                  Boolean(result.principal.delegation) !==\n                    Boolean(source.delegates))\n              ) {\n                throw new Error(\n                  `Principal source ${source.id} violated its declared principal contract`,\n                );\n              }\n              if (result.outcome !== \"absent\") {\n                return result;\n              }\n            } catch (error) {\n              const failure = normalizeForRequest(\n                error,\n                \"source\",\n                source.id,\n                entry,\n                headers,\n              );\n              if (isAuthFailure(failure)) {\n                return rejected(failure);\n              }\n              throw error;\n            }\n          }\n          return absent();\n        },\n      );\n    };\n    return request.reclassify\n      ? compute()\n      : this.scope.memoPrincipal(\n          call,\n          {\n            instance: entry.name,\n            freshness: request.freshness,\n            sourceSet: request.sourceSet,\n          },\n          compute,\n        );\n  }\n}\n","import {\n  Inject,\n  Injectable,\n  type CallHandler,\n  type ExecutionContext,\n  type NestInterceptor,\n} from \"@nestjs/common\";\nimport { Observable } from \"rxjs\";\nimport type { PrincipalReading, TransportCall } from \"./auth-contracts.js\";\nimport { AUTH_ENHANCER, READER_CONTEXT, SCOPE_CORE } from \"./auth-tokens.js\";\nimport type { ScopeView } from \"./bridge-protocol.js\";\nimport type { InstanceLookup } from \"./instance-registry.js\";\nimport type { PrincipalReadings } from \"./principal-readings.js\";\nimport { requestHeaders } from \"./principal-resolver.js\";\nimport type { RequestScope, ScopeState } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\n@Injectable()\nexport class BetterAuthScopeInterceptor implements NestInterceptor {\n  static readonly [AUTH_ENHANCER] = \"scope\";\n  readonly [AUTH_ENHANCER] = \"scope\";\n\n  constructor(\n    @Inject(SCOPE_CORE) private readonly core: Pick<ScopeCore, \"intercept\">,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    return this.core.intercept(context, next);\n  }\n}\nexport class ScopeCore implements NestInterceptor {\n  constructor(\n    private readonly instances: InstanceLookup,\n    private readonly planner: RoutePlanner,\n    private readonly transports: TransportRegistry,\n    private readonly scope: RequestScope,\n    private readonly readings: PrincipalReadings,\n  ) {}\n\n  intercept(context: ExecutionContext, next: CallHandler): Observable<unknown> {\n    const plan = this.planner.forContext(context);\n    const entry = this.instances.get(plan.instance);\n    let described = false;\n    let call: TransportCall | undefined;\n    const getCall = (): TransportCall | undefined => {\n      if (!described) {\n        const transport = this.transports.find(context);\n        call = transport\n          ? this.transports.describe(context, transport)\n          : undefined;\n        described = true;\n      }\n      return call;\n    };\n    let reading: PrincipalReading | undefined;\n    const read = (): PrincipalReading => {\n      if (reading) {\n        return reading;\n      }\n      const lineage = this.transports.find(context)?.lineage?.(context);\n      reading = this.readings.read({\n        args: context.getArgs(),\n        plan,\n        lineage,\n        ...(plan.access === \"public\" || plan.access === \"inherit\"\n          ? {}\n          : { call: getCall() }),\n      });\n      return reading;\n    };\n    const instances = this.instances;\n    const view: ScopeView = {\n      get cookies() {\n        return getCall()?.cookies ?? null;\n      },\n      forward: plan.forwardDirectCalls ? \"same-credential\" : \"none\",\n      internal: false,\n      get inbound() {\n        return () => {\n          const call = getCall();\n          return call ? requestHeaders(call, entry) : new Headers();\n        };\n      },\n      get browserHeaders() {\n        const browser = getCall()?.browser;\n        return browser ? () => browser.headers() : undefined;\n      },\n      get checkCallerSession() {\n        if (plan.originCheck === \"off\") {\n          return undefined;\n        }\n        const browser = getCall()?.browser;\n        return browser\n          ? (path: string, instance: string) =>\n              instances\n                .get(instance)\n                .origin.assertCallerSession(browser, path, instance)\n          : undefined;\n      },\n    };\n    const state: ScopeState = {\n      view,\n      plan,\n      reading: read,\n      get call() {\n        return getCall();\n      },\n    };\n    const args = context.getArgs();\n    const bridge = {\n      args: [...args],\n      reading: read,\n      scope: this.scope,\n      readings: this.readings,\n    };\n    for (const arg of [args, ...args]) {\n      if (\n        arg &&\n        (typeof arg === \"object\" || typeof arg === \"function\") &&\n        Object.isExtensible(arg)\n      ) {\n        Object.defineProperty(arg, READER_CONTEXT, {\n          value: bridge,\n          configurable: true,\n        });\n      }\n    }\n    return new Observable((subscriber) =>\n      this.scope.run(state, () => {\n        const subscription = next.handle().subscribe({\n          next: (value) => this.scope.run(state, () => subscriber.next(value)),\n          error: (error) =>\n            this.scope.run(state, () => subscriber.error(error)),\n          complete: () => this.scope.run(state, () => subscriber.complete()),\n        });\n        return () => this.scope.run(state, () => subscription.unsubscribe());\n      }),\n    );\n  }\n}\n"],"mappings":";;;;;AAqBA,MAAa,yBACX,WACuB;AACzB,MAAa,iBACX,eACwB;CAAE,SAAS;CAAiB;AAAU;AAChE,MAAa,gBAAwC,EAAE,SAAS,SAAS;AACzE,MAAa,YAAY,aAAkD;CACzE,SAAS;CACT;AACF;AAEA,IAAa,WAAb,MAAsB;CACpB,yBAA0B,IAAI,QAO5B;CAEF,IACE,OACA,WACA,OACQ;EACR,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,UAAU;GAAC;GAAW;GAAU;EAAK,CAAC;EAEpD,IAAI,aAAa,KAAK,OAAO,IAAI,KAAK;EACtC,IAAI,CAAC,YAAY;GACf,aAAa;IAAE,yBAAS,IAAI,QAAQ;IAAG,yBAAS,IAAI,IAAI;IAAG,MAAM;GAAE;GACnE,KAAK,OAAO,IAAI,OAAO,UAAU;EACnC;EACA,IAAI,KACF,OAAO,UAAU,WACb,WAAW,QAAQ,IAAI,KAAK,IAC5B,WAAW,QAAQ,IAAI,KAAK;EAClC,IAAI,OAAO,KAAA,GAAW;GACpB,KAAK,EAAE,WAAW;GAClB,IAAI,OAAO,UAAU,UACnB,WAAW,QAAQ,IAAI,OAAO,EAAE;QAEhC,WAAW,QAAQ,IAAI,OAAO,EAAE;EAEpC;EACA,OAAO,KAAK,UAAU;GAAC;GAAW,OAAO;GAAO;EAAE,CAAC;CACrD;AACF;AACA,SAAgB,eACd,MACA,OACS;CACT,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CAAC;CAC1C,KAAK,MAAM,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GACnC,IACE,KAAK,WAAW,GAAG,KACnB,KAAK,WAAW,8BAA8B,KAC9C,SAAS,MAAM,OAAO,gBAEtB,QAAQ,OAAO,IAAI;CAGvB,IAAI,MAAM,OAAO,kBAAkB,KAAK,UACtC,QAAQ,IAAI,MAAM,OAAO,gBAAgB,KAAK,QAAQ;CAExD,OAAO;AACT;AACA,SAAgB,oBACd,OACA,OACA,MACA,OACA,SACA;CACA,IAAI;EACF,OAAO,gBAAgB,OAAO,OAAO,MAAM,CAAC,GAAG,MAAM,QAAQ,MAAM;CACrE,SAAS,YAAY;EACnB,IAAI,qBAAqB,UAAU,GACjC,MAAM;EAER,IAAI,sBAAsB,KAAK,KAAK,eAAe,OAEjD,MAAM,iBAAiB,OAAO;GAC5B;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;EAEH,MAAM,0BAA0B,OAAO;GACrC;GACA,mBAAmB,MAAM;GACzB,gBAAgB,MAAM,QAAQ,QAAQ;EACxC,CAAC;CACH;AACF;AACA,IAAa,yBAAb,MAAiE;CAI5C;CACA;CACA;CALnB,OAAwB,IAAI,SAAS;CAErC,YACE,WACA,OACA,YACA;EAHiB,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,aAAA;CAChB;CAEH,QACE,MACA,SAC0B;EAC1B,MAAM,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,IAAI;EAClD,MAAM,UAAU,YAAsC;GACpD,MAAM,UAAU,eAAe,MAAM,KAAK;GAC1C,MAAM,UAAU,QAAQ,aACpB,MAAM,QAAQ,QACX,WACC,OAAO,OAAO,QAAQ,WAAY,YAClC,OAAO,aACX,IACA,MAAM,QAAQ,QAAQ,WACpB,OAAO,MAAM,MAAM,SAAS,QAAQ,QAAQ,IAAI,IAAI,CAAC,CACvD;GACJ,OAAO,QAAQ,KAAK,IAClB;IACE,SAAS,KAAK;IACd,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,KAAK,MAAM,UAAU,SAAS;KAC5B,MAAM,QAAQ;MACZ;MACA,SAAS,KAAK;MACd,WAAW,KAAK,WAAW,KAAK,IAAI;MACpC,SAAS,KAAK;MACd,WAAW,QAAQ;MACnB,MAAM,QAAQ;MACd,OACE,KACA,OAEA,KAAK,MAAM,aACT,KAAK,KACL,MAAM,MACN,KAAK,KAAK,IAAI,KAAK,KAAK,UAAU,OAAO,MAAM,GAAG,GAClD,IACA,MAAM,QAAQ,QAAQ,+BACxB;KACJ;KACA,IAAI;MACF,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,KAAK,GAC7C;MAEF,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,IACE,OAAO,YAAY,oBAClB,CAAC,OAAO,MAAM,SAAS,OAAO,UAAU,IAAI,KAC3C,OAAO,UAAU,WAAW,OAAO,MACnC,QAAQ,OAAO,UAAU,UAAU,MACjC,QAAQ,OAAO,SAAS,IAE5B,MAAM,IAAI,MACR,oBAAoB,OAAO,GAAG,0CAChC;MAEF,IAAI,OAAO,YAAY,UACrB,OAAO;KAEX,SAAS,OAAO;MACd,MAAM,UAAU,oBACd,OACA,UACA,OAAO,IACP,OACA,OACF;MACA,IAAI,cAAc,OAAO,GACvB,OAAO,SAAS,OAAO;MAEzB,MAAM;KACR;IACF;IACA,OAAO,OAAO;GAChB,CACF;EACF;EACA,OAAO,QAAQ,aACX,QAAQ,IACR,KAAK,MAAM,cACT,MACA;GACE,UAAU,MAAM;GAChB,WAAW,QAAQ;GACnB,WAAW,QAAQ;EACrB,GACA,OACF;CACN;AACF;;;ACzMO,IAAM,6BAAN,MAAM,2BAAsD;CAK1B;CAJvC,QAAiB,iBAAiB;CAClC,CAAU,iBAAiB;CAE3B,YACE,MACA;EADqC,KAAA,OAAA;CACpC;CAEH,UAAU,SAA2B,MAAwC;EAC3E,OAAO,KAAK,KAAK,UAAU,SAAS,IAAI;CAC1C;AACF;;CAZC,WAAW;CAMP,gBAAA,GAAA,OAAO,UAAU,CAAA;;;AAOtB,IAAa,YAAb,MAAkD;CAE7B;CACA;CACA;CACA;CACA;CALnB,YACE,WACA,SACA,YACA,OACA,UACA;EALiB,KAAA,YAAA;EACA,KAAA,UAAA;EACA,KAAA,aAAA;EACA,KAAA,QAAA;EACA,KAAA,WAAA;CAChB;CAEH,UAAU,SAA2B,MAAwC;EAC3E,MAAM,OAAO,KAAK,QAAQ,WAAW,OAAO;EAC5C,MAAM,QAAQ,KAAK,UAAU,IAAI,KAAK,QAAQ;EAC9C,IAAI,YAAY;EAChB,IAAI;EACJ,MAAM,gBAA2C;GAC/C,IAAI,CAAC,WAAW;IACd,MAAM,YAAY,KAAK,WAAW,KAAK,OAAO;IAC9C,OAAO,YACH,KAAK,WAAW,SAAS,SAAS,SAAS,IAC3C,KAAA;IACJ,YAAY;GACd;GACA,OAAO;EACT;EACA,IAAI;EACJ,MAAM,aAA+B;GACnC,IAAI,SACF,OAAO;GAET,MAAM,UAAU,KAAK,WAAW,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO;GAChE,UAAU,KAAK,SAAS,KAAK;IAC3B,MAAM,QAAQ,QAAQ;IACtB;IACA;IACA,GAAI,KAAK,WAAW,YAAY,KAAK,WAAW,YAC5C,CAAC,IACD,EAAE,MAAM,QAAQ,EAAE;GACxB,CAAC;GACD,OAAO;EACT;EACA,MAAM,YAAY,KAAK;EA8BvB,MAAM,QAAoB;GACxB,MAAA;IA7BA,IAAI,UAAU;KACZ,OAAO,QAAQ,CAAC,EAAE,WAAW;IAC/B;IACA,SAAS,KAAK,qBAAqB,oBAAoB;IACvD,UAAU;IACV,IAAI,UAAU;KACZ,aAAa;MACX,MAAM,OAAO,QAAQ;MACrB,OAAO,OAAO,eAAe,MAAM,KAAK,IAAI,IAAI,QAAQ;KAC1D;IACF;IACA,IAAI,iBAAiB;KACnB,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,gBAAgB,QAAQ,QAAQ,IAAI,KAAA;IAC7C;IACA,IAAI,qBAAqB;KACvB,IAAI,KAAK,gBAAgB,OACvB;KAEF,MAAM,UAAU,QAAQ,CAAC,EAAE;KAC3B,OAAO,WACF,MAAc,aACb,UACG,IAAI,QAAQ,CAAC,CACb,OAAO,oBAAoB,SAAS,MAAM,QAAQ,IACvD,KAAA;IACN;GAGG;GACH;GACA,SAAS;GACT,IAAI,OAAO;IACT,OAAO,QAAQ;GACjB;EACF;EACA,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,SAAS;GACb,MAAM,CAAC,GAAG,IAAI;GACd,SAAS;GACT,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB;EACA,KAAK,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAC9B,IACE,QACC,OAAO,QAAQ,YAAY,OAAO,QAAQ,eAC3C,OAAO,aAAa,GAAG,GAEvB,OAAO,eAAe,KAAK,gBAAgB;GACzC,OAAO;GACP,cAAc;EAChB,CAAC;EAGL,OAAO,IAAI,YAAY,eACrB,KAAK,MAAM,IAAI,aAAa;GAC1B,MAAM,eAAe,KAAK,OAAO,CAAC,CAAC,UAAU;IAC3C,OAAO,UAAU,KAAK,MAAM,IAAI,aAAa,WAAW,KAAK,KAAK,CAAC;IACnE,QAAQ,UACN,KAAK,MAAM,IAAI,aAAa,WAAW,MAAM,KAAK,CAAC;IACrD,gBAAgB,KAAK,MAAM,IAAI,aAAa,WAAW,SAAS,CAAC;GACnE,CAAC;GACD,aAAa,KAAK,MAAM,IAAI,aAAa,aAAa,YAAY,CAAC;EACrE,CAAC,CACH;CACF;AACF"}

package/dist/bridge-protocol-BDw8opAG.cjs

@@ -0,0 +1,25 @@
+//#region src/bridge-protocol.ts
+const BRIDGE_HANDLE = Symbol.for("@nestjs-kit/better-auth:bridge");
+const EXTENSION_DEFINITION = Symbol.for("@nestjs-kit/better-auth:extension");
+const UPGRADE_REQUEST = Symbol.for("@nestjs-kit/better-auth:upgrade-request");
+//#endregion
+Object.defineProperty(exports, "BRIDGE_HANDLE", {
+	enumerable: true,
+	get: function() {
+		return BRIDGE_HANDLE;
+	}
+});
+Object.defineProperty(exports, "EXTENSION_DEFINITION", {
+	enumerable: true,
+	get: function() {
+		return EXTENSION_DEFINITION;
+	}
+});
+Object.defineProperty(exports, "UPGRADE_REQUEST", {
+	enumerable: true,
+	get: function() {
+		return UPGRADE_REQUEST;
+	}
+});
+
+//# sourceMappingURL=bridge-protocol-BDw8opAG.cjs.map

package/dist/bridge-protocol-BDw8opAG.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-protocol-BDw8opAG.cjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}

package/dist/bridge-protocol-c66aEkr5.mjs

@@ -0,0 +1,8 @@
+//#region src/bridge-protocol.ts
+const BRIDGE_HANDLE = Symbol.for("@nestjs-kit/better-auth:bridge");
+const EXTENSION_DEFINITION = Symbol.for("@nestjs-kit/better-auth:extension");
+const UPGRADE_REQUEST = Symbol.for("@nestjs-kit/better-auth:upgrade-request");
+//#endregion
+export { EXTENSION_DEFINITION as n, UPGRADE_REQUEST as r, BRIDGE_HANDLE as t };
+
+//# sourceMappingURL=bridge-protocol-c66aEkr5.mjs.map

package/dist/bridge-protocol-c66aEkr5.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-protocol-c66aEkr5.mjs","names":[],"sources":["../src/bridge-protocol.ts"],"sourcesContent":["import type { HookEndpointContext } from \"better-auth\";\nimport type { CookieSink, DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type { DatabaseHookMethod } from \"./auth-types.js\";\n\nexport const BRIDGE_HANDLE = Symbol.for(\"@nestjs-kit/better-auth:bridge\");\nexport const EXTENSION_DEFINITION = Symbol.for(\n  \"@nestjs-kit/better-auth:extension\",\n);\nexport const UPGRADE_REQUEST = Symbol.for(\n  \"@nestjs-kit/better-auth:upgrade-request\",\n);\n\nexport interface BridgeHandle {\n  readonly protocol: 4; // checked by core (B04); v5: binding state and instance, the caller-session check\n  readonly clientIpHeader: string | null; // single source of truth for the header name (§6.8)\n  /** 'unbound' until the first bind(); 'bound' while an application's hooks are registered; 'closed' after its shutdown, hooks still registered. */\n  readonly state: \"unbound\" | \"bound\" | \"closed\";\n  /** Endpoint dispatches and database-hook dispatches (writes) seen before the first binding, reset by every bind() (B26). */\n  readonly unboundDispatches: number;\n  /**\n   * Registers the application's hooks and returns close(), which the kernel calls in onApplicationShutdown: a closed binding keeps\n   * dispatching until another application binds (§10.6). A second bind() from the same owner for the same instance is a no-op that\n   * returns the existing registration (NestMicroservice.init() runs lifecycle hooks twice); from the same owner for another instance it\n   * throws PLUGIN_SHARED_BETWEEN_INSTANCES (B03). Throws INSTANCE_ALREADY_BOUND if another bootstrapped application is bound; takes over\n   * a never-bootstrapped one (reported, B06) and a closed one (silently). A never-bootstrapped binding it takes over becomes\n   * 'displaced': an application whose init() was still running when another bound fails in onApplicationBootstrap (B06).\n   */\n  bind(binding: BridgeBinding): { close(): void; tookOverFrom?: string };\n  /** true when an endpoint returned `value` (an object) in a non-router dispatch observed while bound; false for before-hook short-circuits (LEAD-V37). */\n  producedByEndpoint(value: unknown): boolean;\n}\nexport interface BridgeBinding {\n  /** The application: compared by identity for the same-owner no-op; `description` goes into the B06 message. */\n  readonly owner: { readonly description: string };\n  /** The instance this plugin object serves; one plugin object serves one instance (B03). */\n  readonly instance: string;\n  /**\n   * 'initialized' at bind; the kernel sets 'bootstrapped' in onApplicationBootstrap; close() sets 'closed'; bind() of another\n   * application sets 'displaced' on an 'initialized' binding it takes over.\n   */\n  state: \"initialized\" | \"bootstrapped\" | \"closed\" | \"displaced\";\n  /** View of the kernel's RequestScope; the plugin never owns an AsyncLocalStorage. [C] */\n  current(): ScopeView | undefined;\n  /** Credential header names declared by the instance's principal sources (credential matching, §7.5). */\n  readonly credentialHeaders: readonly string[];\n  readonly before: readonly CompiledHook[]; // sorted by order, then discovery order\n  readonly after: readonly CompiledHook[];\n  readonly database: Readonly<{\n    [E in DatabaseHookTarget]: {\n      readonly before: readonly DatabaseHookMethod<E, \"before\">[];\n      readonly after: readonly DatabaseHookMethod<E, \"after\">[];\n    };\n  }>;\n  /** Debug log when the bridge drops a direct call's cookies because its credential is foreign. */\n  onDropped(path: string): void;\n}\nexport interface ScopeView {\n  /** Cookie-capable forwarding handlers have already passed the enforcing form check on every method/operation (§7.10). */\n  readonly cookies: CookieSink | null;\n  readonly forward: \"none\" | \"same-credential\" | \"any\";\n  readonly inbound: (() => Headers) | undefined;\n  readonly internal: boolean;\n  /**\n   * Present in EVERY handler scope whose transport exposes a browser leg, unless the plan's origin check is 'off' — enforcing or not,\n   * so safe methods and GraphQL queries are covered too (§7.5). Returns when this leg has a passing origin verdict for `instance`, or\n   * the single kernel disable predicate (§7.10 item 4) holds; a guard run without a passing verdict is insufficient. Otherwise throws the kernel's\n   * BetterAuthConfigurationError PUBLIC_HANDLER_USED_CALLER_SESSION.\n   */\n  readonly checkCallerSession?: (path: string, instance: string) => void;\n  /** The browser leg's OWN headers (TransportCall.browser.headers()), before any transport credential mapping replaced them; undefined\n   * when the transport exposes no browser leg. Entry 2 recognizes an ambiently carried session cookie with it. */\n  readonly browserHeaders: (() => Headers) | undefined;\n}\nexport interface CompiledHook {\n  /**\n   * Evaluate the user predicate once and let it throw. The dispatcher logs and\n   * converts before-hook matcher failures to APIError 500; after-hook matcher\n   * failures cross the next fixed SDK matcher boundary unchanged, so the SDK\n   * cannot recover them as handler APIErrors. Never swallow a failure as a\n   * non-match or evaluate the predicate again in run().\n   */\n  matches(ctx: HookEndpointContext, scope: ScopeView | undefined): boolean;\n  run(ctx: HookEndpointContext): Promise<unknown>;\n}\n"],"mappings":";AAIA,MAAa,gBAAgB,OAAO,IAAI,gCAAgC;AACxE,MAAa,uBAAuB,OAAO,IACzC,mCACF;AACA,MAAa,kBAAkB,OAAO,IACpC,yCACF"}